# Growth, residency and compliance factors

*Integration Architect Study Guide · Evaluate Business Needs · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/integration-architect/evaluate-business-needs/growth-residency-and-compliance-factors*

How expected growth (acquisitions, tenfold volume) and regulation (data residency, GDPR transfers, GDPR and CCPA consent, HIPAA, PCI DSS) change which integration solution fits, from a hub or event bus instead of point-to-point links to Shield, Field Audit Trail, tokenization and consent-aware Data 360 activation.

- Certification: Salesforce Integration Architect
- Exam section: Evaluate Business Needs
- Study guide: https://www.certifyforce.com/study-guide/integration-architect

**Official exam objective:**

> Given a use case, identify the business growth and regulatory factors that can impact choice of integration solutions.

## What the exam expects

- Choose an integration architecture that absorbs growth such as acquisitions (hub, ESB or event bus) instead of more point-to-point links.
- Evaluate growth against API allocations, platform event add-ons and large data volumes before picking an option.
- Advise on data residency: when the existing org cannot meet a localization mandate, and when GDPR needs a transfer mechanism rather than EU hosting.
- Capture consent requirements per jurisdiction (GDPR opt-in, CCPA opt-out of sale or sharing) and propagate withdrawals across systems.
- Name the integration controls for HIPAA (Shield Platform Encryption, Field Audit Trail) and PCI DSS (tokenization instead of storing card numbers).
- Key terms: **mandatory localization** (law requiring data to stay in-country); **transfer mechanism** (adequacy decision, SCCs or BCRs for cross-border flows); **SCCs** (Standard Contractual Clauses); **tokenization** (replacing a card number with a payment gateway token); **consent-aware activation** (Data 360 excluding records whose consent flags forbid sharing).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| New systems join the bus | A new subscriber needs no custom point-to-point integration | [Event-Driven Architectures](https://architect.salesforce.com/docs/architect/decision-guides/guide/event-driven.html) |
| Migrating off point-to-point | Incremental: most business-critical applications first | [Event-Driven Architectures](https://architect.salesforce.com/docs/architect/decision-guides/guide/event-driven.html) |
| High-volume events | Add-on required for high-volume platform event and CDC use cases | [Data Integration with Salesforce](https://architect.salesforce.com/docs/architect/decision-guides/guide/data-integration.html) |
| Limits headroom | Reliability guidance uses a 70% operational ceiling for governor limits | [Well-Architected Framework](https://architect.salesforce.com/docs/architect/well-architected/guide/framework.html) |
| Org residency | Fixed at provisioning; regions exist only where Salesforce operates one | [Trust](https://architect.salesforce.com/docs/architect/well-architected/guide/trust.html) |
| No in-country region | Residency overlay or separate org for the mandated data | [Trust](https://architect.salesforce.com/docs/architect/well-architected/guide/trust.html) |
| GDPR transfers | Adequate protection, not EU deployment; adequacy, SCCs or BCRs; consent last | [Trust](https://architect.salesforce.com/docs/architect/well-architected/guide/trust.html) |
| Consent models | GDPR/LGPD opt-in, purpose-specific; CCPA/CPRA opt-out of sale or sharing | [Trust](https://architect.salesforce.com/docs/architect/well-architected/guide/trust.html) |
| Data 360 activation | Consent flags evaluated before activation; each activation logged with lineage | [Data 360 Security Architecture](https://architect.salesforce.com/docs/architect/fundamentals/guide/data360_security_architecture) |
| HIPAA | Shield on all PHI fields plus Field Audit Trail with retention policies | [Trust](https://architect.salesforce.com/docs/architect/well-architected/guide/trust.html) |
| PCI DSS | Do not store full PAN; tokenize via the payment gateway | [Trust](https://architect.salesforce.com/docs/architect/well-architected/guide/trust.html) |
| Classic Encryption scope | Custom text fields only, 175 characters | [Classic Encryption for Custom Fields](https://help.salesforce.com/s/articleView?id=sf.fields_about_encrypted_fields.htm&type=5) |

## Check yourself

- Why can't an EU company's legal team insist the middleware must run in the EU under GDPR?
- When does the existing org fail to meet a residency requirement?
- Which two controls does Salesforce's guidance require for PHI fields?
- What growth factors should be weighed for a tenfold order increase?

## Sources

- [Trust | Well-Architected](https://architect.salesforce.com/docs/architect/well-architected/guide/trust.html)
- [Data 360 Security Architecture](https://architect.salesforce.com/docs/architect/fundamentals/guide/data360_security_architecture)
- [Data Integration with Salesforce](https://architect.salesforce.com/docs/architect/decision-guides/guide/data-integration.html)
- [Event-Driven Architecture Decision Guide](https://architect.salesforce.com/docs/architect/decision-guides/guide/event-driven.html)
- [Well-Architected Framework](https://architect.salesforce.com/docs/architect/well-architected/guide/framework.html)
- [Add Filters to Contact Points in Activation](https://help.salesforce.com/s/articleView?id=data.c360_a_contact_point_filtering.htm&language=en_US&type=5)
- [What to Expect During Hyperforce Fleet Management](https://help.salesforce.com/s/articleView?id=005390954&language=en_US&type=1)
- [Classic Encryption for Custom Fields](https://help.salesforce.com/s/articleView?id=sf.fields_about_encrypted_fields.htm&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 8 linked practice questions, and unlimited timed mock exams are included with the Integration Architect pack (USD $19): https://www.certifyforce.com/practice-exams